Bug 155234

Summary: Harden JSC Root element functions from bad values
Product: WebKit Reporter: Michael Saboff <msaboff>
Component: JavaScriptCoreAssignee: Michael Saboff <msaboff>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ddkilzer, keith_miller, mark.lam, saam
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch saam: review+

Michael Saboff
Reported 2016-03-09 09:40:59 PST
The Root related functionCreateElement(), functionGetElement() and functionSetElementRoot() currently do not protect against bad values. In some cases, fuzzer code will cause crashes in this code. Their jsCast() calls should be replaced with jsDynamicCast() and appropriate checks.
Attachments
Patch (2.46 KB, patch)
2016-03-09 09:57 PST, Michael Saboff 		saam: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Michael Saboff
Comment 1 2016-03-09 09:57:57 PST
Created attachment 273438 [details] Patch
Michael Saboff
Comment 2 2016-03-09 10:10:46 PST
Committed r197862: <http://trac.webkit.org/changeset/197862>
David Kilzer (:ddkilzer)
Comment 3 2016-05-09 20:40:20 PDT
<rdar://problem/24291166>
Note You need to log in before you can comment on or make changes to this bug.